So this identifies AppHelp.dll. AppHelp.dll's exports deal with a range of different functions related to the shim engine including the SDB (database) files as well as the other functions called by the loader. If we turn on 'Show loader snaps' (also a good read regarding loader snapshots) via gflags.exe (Global Flags) we see the following:

So an interesting feature we noticed in AppHelp.dll was the shim debug levels. There is a function called GetShimDbgLevel() which returns an INT. This function simply returns the value of environment variable SHIM_DEBUG_LEVEL. The story of our lives continued, using Google to search for this variable name turns up an interesting blog post from the Microsoft AppCompat guy from 2008 on enabling diagnostic output from shims.

Interesting Bit About NX Compatibility and Section Names in the NT Loader

While digging through NTDLL.dll we noticed the function _LdrpCheckNXCompatibility which among other things calls LdrpCheckNxIncompatibleDllSection. LdrpCheckNxIncompatibleDllSection checks if any of the sections are named: